Banks Push Back on AI Agents: Who Pays When Software Moves Your Money?

For two years, the pitch for AI agents in personal finance has been simple: give the software access to your accounts and let it pay bills, shop for better rates, rebalance a portfolio or book a trip. In late October 2026 the banks that hold those accounts are pushing back. Reports from across North America describe a growing list of lenders that are restricting, or considering restricting, outside agents from reaching customer accounts.

This article explains what is happening, why liability is at the centre of the dispute, what it means for customers and fintechs, and how finance teams should think about agent access in their own banking relationships.

What the banks are actually saying

The most direct public warning has come from Jamie Dimon at JPMorgan Chase. Coverage of his remarks describes a “liability transfer”: when a customer hands an agent the keys to an account, the customer, not the bank, is expected to carry the risk of what the agent does. JPMorgan has been reported as blocking external AI agents from customer accounts altogether.

Citi and Bank of America have also restricted third-party agents. Bank of America’s Brian Moynihan was quoted as saying the bank is limiting access while it develops protocols to establish which party is liable for payments authorised by artificial intelligence. That phrasing matters. It does not describe a permanent ban; it describes a pause until the rules of responsibility exist.

In Canada, the debate reached the front page of the industry press this week. Finextra reported that the chiefs of RBC and BMO were the latest bank leaders to warn customers about the dangers of linking accounts to AI agents. The detail in other reporting is more precise: RBC’s chief executive, Dave McKay, said on Bloomberg Television that the bank is weighing whether to block Meta’s agent from reaching customer information, with no final decision made. He raised unauthorised data access, fraudulent consent and liability as autonomous agents increasingly carry out transactions. BMO’s contribution, from its chief AI and quantum officer Kristin Milchanowski, was less a warning than a forecast: people will be using AI agents for shopping and investing within six months, and consumer-facing companies must think about how they interact with and market to agents as well as to humans.

Why liability is the real fight

Consumer banking law in most markets was written around a human who initiates, or authorises, each payment. Protections such as chargebacks, unauthorised-transaction refunds and fraud liability limits assume that either the customer did something or a criminal did. An agent introduces a third category: a transaction the customer technically authorised in general terms but never approved in detail.

Consider three scenarios banks are worried about:

• The misread instruction. A customer tells an agent to “pay off the card”. The agent pays the full balance from a savings account that was earmarked for tax. Was that authorised?
• The manipulated agent. A malicious web page or email contains hidden instructions that steer an agent into moving funds. The customer did not act; the agent did, but it was deceived.
• The over-broad consent. A user clicks through a permission screen granting an agent wide access, then disputes a transaction they did not expect. “Fraudulent consent” is the phrase McKay used for this family of problems.

In each case the bank is the party with the deepest pockets and the regulatory duty, yet it has no visibility into the software making the decisions. From a risk officer’s perspective, blocking agents until responsibility is allocated is the conservative move. From a product perspective, it is a way to keep control of the customer relationship while the bank builds its own agents.

The competitive subtext

It would be naive to read the restrictions as purely defensive risk management. Banks have fought for years over who owns the customer interface. Open banking regimes and data-aggregation APIs forced them to share data with fintechs under defined terms. General-purpose AI agents threaten to go further by sitting on top of the bank app and turning it into a back-end utility. If an agent chooses the savings account, the card and the loan, the bank’s brand stops mattering to the customer.

That is why the language from executives mixes safety and strategy. Banks want agent traffic to arrive through sanctioned channels, with authentication, spending limits and audit trails they define. They also want the economics: who pays for the API calls, and whether the agent’s operator shares revenue. BMO’s remark that companies must learn to market to agents is a tell. Agents will be a distribution channel, and the question is on whose terms.

What a workable framework might look like

Nobody has published a settled standard, so this section describes the components most proposals share rather than a finished rule.

1. Delegated, scoped credentials. Instead of handing over a password, a customer issues a token limited by action (view, pay existing payees), amount, merchant category and time. The token can be revoked instantly.
2. Agent identity. The bank can see which agent, run by which operator, is making a request, rather than an anonymous session that looks like a customer.
3. Step-up confirmation. Payments above a threshold, or to new payees, require the human to approve in the bank’s own app.
4. A liability matrix. Contracts or regulation specify who bears losses when an agent errs, is manipulated, or is compromised. This is the missing piece Moynihan referred to.
5. Logs. A tamper-evident record of what the agent was told and what it did, so disputes can be resolved on evidence.

None of these is technically exotic. Payments already uses tokenisation, strong customer authentication and mandate-based direct debits. The hard part is commercial and legal agreement across thousands of institutions and a handful of dominant AI platforms.

What this means for customers

If you are an individual using, or considering, an AI agent with financial access, the practical implications are straightforward.

• Assume you carry the risk. Dimon’s liability-transfer framing is a signal that banks may not reimburse losses caused by an agent you authorised.
• Prefer read-only access first. Letting an agent analyse spending is much safer than letting it move money.
• Use separate accounts. If you experiment, keep a small balance in an account the agent can touch, and the rest out of reach.
• Check whether your bank will block it. An agent that works today may stop working if your bank tightens rules, which can leave bills unpaid if you relied on it.

What this means for fintechs and AI platforms

Fintechs that built businesses on data aggregation have seen this film before, when banks restricted screen scraping in favour of APIs. The agent era will probably follow a similar arc: a period of blocking and negotiation, followed by formal access agreements for operators that accept liability, security requirements and fees. Startups that can offer compliant agent infrastructure, such as identity, consent management, monitoring and insurance, may find a market selling to both sides.

For AI platforms, the lesson is that general-purpose capability does not equal permission. Having an agent that can use a browser does not give it the right to operate inside a bank’s authenticated session. The platforms that win financial use cases will likely be those that sign agreements with banks early.

What finance teams should do now

Corporate treasury and finance functions are experimenting with agents too, for reconciliations, payment preparation and cash reporting. The same questions apply at larger scale, and the stakes are higher.

• Inventory agent access. List every tool, employee-built automation or vendor feature that touches bank portals, and what credentials it uses.
• Separate preparation from release. Agents can draft payment files; humans or controlled systems should approve and release them. Dual control still applies.
• Ask your bank. Find out the bank’s position on agent access, API options and liability allocation before rolling anything out.
• Update policy. Add agent-specific rules to your delegation-of-authority and information-security policies.
• Test for manipulation. Treat content an agent reads, such as invoices and emails, as untrusted input that could carry instructions.

The resilience link

The agent debate also intersects with operational resilience. This week UK and EU regulators sought answers from Google over a major cloud outage, a reminder that banks and fintechs depend on shared infrastructure. As agents add another dependency layer, a single failure in an agent platform could affect many customers’ payments at once. Regulators who already scrutinise concentration risk in cloud services are likely to ask similar questions about agent providers.

What to watch next

• Whether RBC finalises a decision on blocking Meta’s agent, and how Meta responds.
• Whether other large banks publish formal agent-access policies, or standard terms for sanctioned agents.
• Any regulatory guidance clarifying liability for agent-initiated payments. In the absence of new rules, existing unauthorised-transaction frameworks will be stretched.
• Pilot programmes where banks launch their own agents or approve selected partners.

Bottom line

The banks are not rejecting AI agents; they are refusing to underwrite them on someone else’s terms. Until the industry agrees who bears the loss when software makes a mistake with real money, expect a patchwork of blocks, pilots and carefully scoped permissions. Individuals should treat agent access to money as a risk they personally carry, and finance teams should apply the same controls to agents that they apply to people: limited authority, separation of duties and clear audit trails.

Sources and further reading: Finextra reporting on bank limits for agent access (22 October 2026); coverage of JPMorgan, Citi and Bank of America restrictions on third-party agents; reporting on remarks by RBC’s Dave McKay and BMO’s Kristin Milchanowski. Details reflect public reports as of 25 October 2026 and may change. This article is general information, not financial or legal advice.